Executive Summary
Since May 2026, a suspected China-aligned threat cluster designated as UNK_MassTraction has been targeting physics and engineering departments at major US and Canadian universities. The actor utilizes multi-stage exploitation of Roundcube webmail servers, leveraging n-day vulnerabilities to pivot into high-value academic networks. The campaign appears specifically focused on entities with national security ties or research specializations in astrophysics and particle physics.
The attack chain begins with CVE-2024-42009 (XSS) to deliver the IceCube JavaScript stealer, which captures credentials and session tokens. This is followed by CVE-2025-49113 (PHP Deserialization) to achieve server-side execution. Once established, the actor deploys either the SquareShell webshell or the SNOWLIGHT loader to execute the VShell backdoor in memory. This infrastructure-centric approach treats mailservers as edge devices for network pivoting rather than just data repositories.
This activity represents a significant threat to academic research and national security interests. The maturity of the toolkit, which includes environment checks, clean-up scripts, and sophisticated JavaScript DOM traversal, indicates a persistent adversary with high operational security standards. Organizations running Roundcube should prioritize patching and monitor for unauthorized PHP script creation in plugin directories.